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U.S. as World s Telecommunications Backbone 


* Much of the world's ON 
communications flow 
through the U.S. y A 
* Atarget's phone call, e-mail | 
or chat will take the ili 11 Gbps "dd 
cheapest path, not the $ : 
physically most direct 3 
path — you can't always $ e § 
predict the path. s 3 
* Your target's 
communications could 
easily be flowing into and 
through the U.S. 


Latin America Asia & Pacific 


International Internet Regional Bandwidth Capacity in 2011 
Source: Telegeography Research 
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Two Types of Collection 


Upstream 
"Collection Of 


You 
Should 
Use Both | 

d PRISM 
* Collection directly from the servers of these U.S. 
Service Providers: Microsoft, Yahoo, Google 


Facebook, PalTalk, AOL, Skype, YouTube 
Apple. 
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(TS/SI/NF) FAA 702 Operatıons 


Why Use Both: PRISM vs. Upstream 


PRISM Upstream 

DNI Selectors 9 US. based service Worldwide 
Im d providers ^ sources 

DNR Selectors QS oming soon Z 0. 
Access to Stored 
Communications 
(Search) Y O 
Real-Time Collection 
(Surveillance) Y Y 
“Abouts” Collection O v” 
Voice Collection «f Voice over IP v 


Direct Relationship with 
Comms Providers Oony through FBI 
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ZN PRISM Collection Details aw 
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What Will You Receive in Collection 
(Surveillance and Stored Comms)? 
It varies by provider. In general: 


Current Providers 


E-mail 


* Chat- video, voice 
* Videos 
* Photos 
Stored data 
VoIP 


File transfers 


Video Conferencing 
* Notifications of target activity — logins, etc. 
* Online Social Networking details 


Special Requests 


Complete list and details on PRISM web page: 
Go PRISMFAA TOP SECRET/'SI/ORCON/NOFORN 
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d (susup Dates When PRISM Collection | 
| Began For Each Provider 
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PRISM Program Cost: 
~$20M per year 
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(IS/SUNF) FAA 702 Reporting Highlight 
PRISM.and STORMBREW Combine 


wa | 
SAME-DAY NTOC/FBI COLLABORATION 


PREVENTS 150GB EXFIL EVENT FROM CLEARED DEFENSE CONTRACTOR (CDC) 


2012 14 DEC 3 
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5 FBİ HELPS CDR 
REMOVE ] 
IMPLANT 


€ The FBI contacts the 
CDC and works with 


NTOC TIPS FBI TO 
den INENT THREAT: 
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2) NTOC tips the 
FBI to the activity 


m to clean the 
- PRESENTING 
EXFILTRATION c 
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(tsst’NF) Some Higher Volume Domains 
Collected from FAA Passive 


In addition to Hotmail, Yahoo, Google, Paltalk, Facebook, Skype, AOL: 
Select IP Addresses 


wanadoo.fr 


alcatel-lucent.com 
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Target Analyst inputs selectors into 
Unified Targeting Tool (UTT 


Surveillance - — —— Pending Stored Comms 


Special FISA Oversight and Processing 
(SV4) 


Stored Comms Review /Validation 


Surveillance > <— Pending Stored Comms 
Targeting and Mission Management ($343) 
Final Targeting Review and Release 


Unified Targeting Tool (UTT) 


$2 FAA Adjudicators in Each Product Line 


Targeting Review/Validation 


PRINTAURA, Site Selector 


Distribution Manager 


— Pending Stored Comms 
FBI 
Electronic Communications Surveillance Unit (ECSU) 
Research & Validate NO USPERs 


Surveillance ——» 


Targeting < Stored Comms Release 


Providers Selectors 


PINWALE, 


FBI 


(Google, 
Yahoo, etc.) Callactian 


NUCLEON, 
etc. 
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Data Intercept Technology Unit (DITU) 


Collection 
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PRINTAURA. 
SEIS 


Provider 


( Yahoo. 
Google, etc.) | SCISSORS. MARINA 
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Protocol 
Exploitation. 
$3132 
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NI Content. Videos. 
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(TS//SI/NF) PRISM Case Notations 


P2ESQC 120001234 


əə Sk de | Fixed trigraph, denotes || Year CASN established Em 
ə i PRISM source collection for selector 


: Google 
L Facebook 


E B: IM (chat) 
: YouTube C: RTN-EDC (real-time notification of an e-mail event such as a login 
: Skype or sent message) 
P8: AOL D: RTN-IM (real-time notification of a chat login or logout event) 
PA: Apple E: E-Mail 
E: VoIP 
G: Full (WebForum) 
H: OSN Messaging (photos, wallposts, activity, etc.) 
I: OSN Basic Subscriber Info 
J: Videos 
. (dot): Indicates multiple types 


Content Type 
A: Stored Comms (Search) 
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